Twiner Ph II

Human interaction in cyberspace leaves indicators in the three layers that define cyberspace: persona, logical and physical. The proposed effort seeks to develop algorithms and software to integrate data and context across all three layers, “intertwining” data to create a more holistic and complete picture of cyber activity. Such an integrated perspective will allow cyber professionals to better understand complex activities in and through cyberspace. Twiner aggregates heterogeneous, multi-layer cyberspace data, correlates that data to detect causal relationships across layers, and displays both data and relationships to enable novel cyberspace training and operations.Phase demonstrated feasibility via a software proof-of-concept grounded in a rich and complex dataset. Twiner software was able to “connect the dots” to reveal who was involved when and how in a cyber-training scenario. Phase II will build on this capability to integrate additional data sources, further develop a map of cyberspace features and activities, and investigate additional methods to detect anomalies in large datasets. Phase II will also expand the use cases that Twiner covers, building on the Phase I use case and extending Twiner capabilities to support interpretation and visualization of penetration-team activities during the training exercises.